[WoA] Automate public cross-repository dispatch

[isVoid]

Description

Adds automatic WoA dispatch on top of the merged #3025 workflow, renamed from woa-validation-dispatch.yml to woa-main-ci.yml. The resolver and isolated credential-bearing dispatch job retain the same structure and simplified public run-ID/SHA contract used by the successful manual pilot.

Tracks https://github.com/NVIDIA-dev/cuda-python-private/issues/584. Paired private follow-up: https://github.com/NVIDIA-dev/cuda-python-private/pull/651.

Changes

• Public ci.yml calls woa-main-ci.yml after the Linux and Windows Arm64 build groups succeed on a push to main. Private testing can overlap unrelated public CI jobs.
• The renamed workflow keeps the reviewed two-job layout. Resolution accepts eligible in-progress runs, then one additional read-only step applies the three-commit/two-hour batching policy. The dispatch job runs only when that step selects a batch.
• The existing batching logic lives in ci/tools/select-woa-batch, rather than duplicating source-run resolution or adding another workflow. It uses App-owned successful checks as the baseline and the merged pilot's correlation format to recognize existing attempts.
• lookup-run-id gains optional branch-mode --event filtering. Empty-input lookup uses --branch main --event push --head-sha; callers omitting the new option retain their existing behavior. Filtering is applied to the returned run metadata during the existing commit-history scan.
• Manual dispatch remains available, with an optional run-ID override. An hourly schedule at minute 17 UTC flushes low-volume batches after the two-hour threshold.
• The read-only resolver checks out only the two selection helpers from the current workflow commit with persisted credentials disabled. The job minting the private Actions-write App token still performs no checkout or artifact processing.
• The public workflow dispatches ctk-next-woa-main-ci.yml and checks the returned run's renamed path. Batch baseline/count remain in the public selection summary and are not sent privately. Private artifact discovery remains private; repository IDs, producer-job IDs, run-attempt inputs, and artifact manifests are not reintroduced.
• The completed phase-1 transport diagnostic is removed. There is no woa-main-automation.yml wrapper.

The App result stays informational and independent of public Check job status.

Coordination

Private #651 is aligned with merged #650 and the dispatch contract above. It accepts eligible in-progress public runs, discovers artifacts privately, and reads CUDA/Python versions from ci/versions.yml at the tested public SHA. Its Python matrix runs at most two GB10 jobs concurrently. Merge the private update before this public update so the renamed dispatch endpoint is available.

Validation

• Seven regression cases for lookup-run-id: omitted filter, push/manual event selection, older-commit fallback, unsuccessful push rejection, and invalid event arguments.
• Workflow linting, Bash syntax, Python lint/format checks, and diff checks pass.
• Mocked execution covers in-progress/successful source admission, rejection of failed/cancelled runs, bootstrap, three-commit batching, two-hour flushing, existing-check deduplication, and dispatch without batch metadata.
• Align and simulate private cusolver native routines from cuda-python #651 against the final merged foundation, including dynamic version selection and artifact naming.
• Validate the coordinated automatic/expanded GB10 path after merge; local tests do not execute real private dispatches or GB10 jobs.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[isVoid]

We need build-linux-64 because cuda-pathfinder is built on linux machine.